CVSS: 3.5EPSS: 0%CPEs: 3EXPL: 0CVE-2024-52509 – Nextcloud Mail app does not respect download permissions in shares
https://notcve.org/view.php?id=CVE-2024-52509
Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. The Nextcloud mail app incorrectly allowed attaching shared files without download permissions as attachments. This allowed users to send them the files to themselves and then downloading it from their mail clients. It is recommended that the Nextcloud Mail is upgraded to 2.2.10, 3.6.2 or 3.7.2. • https://github.com/nextcloud/mail/commit/8d44f1ce44684022aa4e62a3e0462fdadcde6c8b https://github.com/nextcloud/mail/pull/9592 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pwpp-fvcr-w862 https://hackerone.com/reports/1878255 • CWE-284: Improper Access Control •
CVSS: 8.2EPSS: 0%CPEs: 5EXPL: 0CVE-2024-52508 – Nextcloud Mail auto configurator can be tricked into sending account information to wrong servers
https://notcve.org/view.php?id=CVE-2024-52508
Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. When a user is trying to set up a mail account with an email address like user@example.tld that does not support auto configuration, and an attacker managed to register autoconfig.tld, the used email details would be send to the server of the attacker. It is recommended that the Nextcloud Mail app is upgraded to 1.14.6, 1.15.4, 2.2.11, 3.6.3, 3.7.7 or 4.0.0. • https://github.com/nextcloud/mail/commit/a84c70e15d814dab6f0e8eda71bbaaf48152079b https://github.com/nextcloud/mail/pull/9964 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vmhx-hwph-q6mc https://hackerone.com/reports/2508422 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.2EPSS: 0%CPEs: 1EXPL: 0CVE-2024-52510 – Nextcloud Desktop client behaves incorrectly if the initial end-to-end-encryption signature is empty
https://notcve.org/view.php?id=CVE-2024-52510
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. The Desktop client did not stop with an error but allowed by-passing the signature validation, if a manipulated server sends an empty initial signature. It is recommended that the Nextcloud Desktop client is upgraded to 3.14.2 or later. • https://github.com/nextcloud/desktop/commit/97539218e6f63c3a3fd1694cb7d8aef27c5910d7 https://github.com/nextcloud/desktop/pull/7333 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-r4qc-m9mj-452v https://hackerone.com/reports/2597504 • CWE-295: Improper Certificate Validation •
CVSS: 3.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-52507 – Share information of the Nextcloud Tables app is not limited to affected users
https://notcve.org/view.php?id=CVE-2024-52507
Nextcloud Tables allows users to to create tables with individual columns. The information which Table (numeric ID) is shared with which groups and users and the respective permissions was not limited to affected users. It is recommended that the Nextcloud Tables app is upgraded to 0.8.1. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-rgvc-xr2w-qq45 https://github.com/nextcloud/tables/commit/13ca45f1b9f70f694aea81b78bc7416ec840c332 https://github.com/nextcloud/tables/pull/1406 https://hackerone.com/reports/2705507 • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 6.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-52511 – Nextcloud Tables has an Authorization Bypass Through User-Controlled Key in Tables
https://notcve.org/view.php?id=CVE-2024-52511
Nextcloud Tables allows users to to create tables with individual columns. By directly specifying the ID of a table or view, a malicious user could blindly insert new rows into tables they have no access to. It is recommended that the Nextcloud Tables is upgraded to 0.8.0. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4qqp-9h2g-7qg7 https://github.com/nextcloud/tables/commit/52846ad81fe192ee977f14c82a229b0d9cdc406c https://github.com/nextcloud/tables/pull/1351 https://hackerone.com/reports/2671404 • CWE-639: Authorization Bypass Through User-Controlled Key •